detection.wiki

Detection rules › Sigma

Firewall rule added using PowerShell or CMD

Status
experimental
Severity
medium
Log source
product windows, service firewall-as
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where a firewall rule is added using PowerShell or CMD.

Known false positives

  • Administrator activity
  • New application installation

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Telemetry coverage

ProviderRecord / event type
Windows-Firewall-With-Advanced-SecurityEvent ID 2004: A rule has been added to the Windows Defender Firewall exception list.

Rule body

title: Firewall rule added using PowerShell or CMD
description: Detects scenarios where a firewall rule is added using PowerShell or CMD.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://kb.eventtracker.com/evtpass/evtPages/EventId_2004_Microsoft-Windows-WindowsFirewallwithAdvancedS_65673.asp
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: firewall-as
detection:
  selection:
    EventID: 2004
    ModifyingApplication|endswith:
      - '\WmiPrvSE.exe' # PowerShell
      - '\netsh.exe' # CMD console
  condition: selection
falsepositives:
- Administrator activity
- New application installation
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 2004
  ModifyingApplication|endswith:
    - '\WmiPrvSE.exe'
    - '\netsh.exe'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ModifyingApplicationends_with
  • \WmiPrvSE.exe
  • \netsh.exe
field:"ModifyingApplication" kind:ends_with